From 0ac4924b69530095384d6cbfef95f9fdf6dd9272 Mon Sep 17 00:00:00 2001 From: Bob Date: Tue, 25 Aug 2026 09:25:09 -0400 Subject: [PATCH 1/2] fix: burn mutable release and gate recovery --- .github/workflows/prepare-release.yml | 7 +++++++ .github/workflows/publish-release.yml | 7 +++++++ README.md | 15 +++++++++------ plugin.toml | 2 +- 4 files changed, 24 insertions(+), 7 deletions(-) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 746ad8c..b1264f1 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -13,6 +13,13 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Verify organization-enforced immutable releases + env: + GH_TOKEN: ${{ github.token }} + run: | + test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ + "repos/${GITHUB_REPOSITORY}/immutable-releases" \ + --jq '.enabled and .enforced_by_owner')" = true - name: Install pinned build tools run: | cargo install just --version 1.57.0 --locked diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 6462b17..44898bb 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -44,6 +44,13 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Verify organization-enforced immutable releases + env: + GH_TOKEN: ${{ github.token }} + run: | + test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ + "repos/${GITHUB_REPOSITORY}/immutable-releases" \ + --jq '.enabled and .enforced_by_owner')" = true - name: Verify dispatch and candidate build identity env: GH_TOKEN: ${{ github.token }} diff --git a/README.md b/README.md index ab12096..80749c8 100644 --- a/README.md +++ b/README.md @@ -20,12 +20,15 @@ the package, and publishes the package, `SHA256SUMS`, and just check just dist just sigil-check -sigil plugin install codec@1.1.1 +sigil plugin install codec@1.1.2 sigil run examples/visible.lua ``` -Version 1.1.1 is the first keyless-provenance release. Sigil verifies and pins -its exact repository, workflow, source commit, protected environment, package, -manifest, and public transparency proof before installation or evaluation. -Earlier releases remain historical bootstrap-digest evidence and are never -promoted in place. +Version 1.1.2 is the first accepted keyless-provenance release. Sigil verifies +and pins its exact repository, workflow, source commit, protected environment, +package, manifest, and public transparency proof before installation or +evaluation. +Version 1.1.1 was published while GitHub release immutability was disabled and +is permanently burned and emergency-denied; its tag and assets are preserved, +never replaced or deleted. Earlier releases remain historical bootstrap-digest +evidence and are never promoted in place. diff --git a/plugin.toml b/plugin.toml index 9c371aa..d62dc5c 100644 --- a/plugin.toml +++ b/plugin.toml @@ -1,6 +1,6 @@ schema_version = 1 name = "codec" -version = "1.1.1" +version = "1.1.2" description = "capability-free reference codec for Sigil plugins" license = "MIT" From 608bfe6fedd64de3100f74272d0a6d80f1df97e3 Mon Sep 17 00:00:00 2001 From: Bob Date: Tue, 25 Aug 2026 09:35:21 -0400 Subject: [PATCH 2/2] fix: make immutability a release authorization gate --- .github/workflows/prepare-release.yml | 7 ------- .github/workflows/publish-release.yml | 12 +++++++----- 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index b1264f1..746ad8c 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -13,13 +13,6 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Verify organization-enforced immutable releases - env: - GH_TOKEN: ${{ github.token }} - run: | - test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ - "repos/${GITHUB_REPOSITORY}/immutable-releases" \ - --jq '.enabled and .enforced_by_owner')" = true - name: Install pinned build tools run: | cargo install just --version 1.57.0 --locked diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 44898bb..4c3e4a4 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -27,6 +27,10 @@ on: description: Exact approved release-manifest.json SHA-256 required: true type: string + immutable_releases_verified: + description: Release approver verified enabled=true and enforced_by_owner=true via the admin API + required: true + type: boolean permissions: {} @@ -44,13 +48,11 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Verify organization-enforced immutable releases + - name: Require authorized immutable-release preflight env: - GH_TOKEN: ${{ github.token }} + IMMUTABLE_RELEASES_VERIFIED: ${{ inputs.immutable_releases_verified }} run: | - test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ - "repos/${GITHUB_REPOSITORY}/immutable-releases" \ - --jq '.enabled and .enforced_by_owner')" = true + test "$IMMUTABLE_RELEASES_VERIFIED" = true - name: Verify dispatch and candidate build identity env: GH_TOKEN: ${{ github.token }}